Two critical flaws in Langflow, the open-source tool for building AI agents and workflows, could let a remote attacker with no account bypass authentication or run arbitrary code on the server. IBM, which handles Langflow’s vulnerability reports, published the details in a bulletin on October 28 and updated it the next day. According to the bulletin, every release from 1.0.0 through 1.12.8 is affected and the fix is Langflow 1.13.0. IBM offers no workaround for servers that cannot upgrade yet, per The Hacker News.
The four flaws in the bulletin are:
| CVE | CVSS (IBM) | Account needed | Impact |
|---|---|---|---|
| CVE-2026-93680 | 9.8 | No | Authentication bypass (improper authentication) |
| CVE-2026-110186 | 9.8 | No | Arbitrary code execution (improper control of code generation) |
| CVE-2026-110193 | 8.8 | Yes, low-privileged | The Agentic Assistant can be made to generate component code that runs operating-system commands |
| CVE-2026-110192 | 6.5 | Yes | Exposure of sensitive information from insufficiently protected credentials |
The Hacker News describes one flaw as unauthenticated remote code execution through the Model Context Protocol (MCP) tool enumeration, and notes that a public Metasploit module already targets CVE-2026-93680. The module connects to a server’s MCP endpoint without credentials, starts a session and lists the server’s tools; it does not run code or commands, and its author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM’s. Neither flaw was in CISA’s Known Exploited Vulnerabilities catalog as of its October 30 update, according to The Hacker News. A separate IBM batch of 29 Langflow CVE records, published October 29, names 1.12.4 and 1.12.5 as fixed versions; one of them, CVE-2026-104339, is rated 9.8 and could also allow unauthenticated code execution. This is separate from the earlier Langflow API-key theft flaw.
How to check if you’re affected
Affected products are Langflow OSS installations running versions 1.0.0 through 1.12.8, per IBM. Version 1.12.8 was released the same day as 1.13.0 (October 22) and still has the flaws, and The Hacker News reports PyPI listed no later 1.12 release as of November 2. Compare your installed package version or Docker image tag against that range.
IBM’s upgrade guidance:
- Back up the database, the secret key and uploaded files.
- If the server uses automatic login, prepare the existing account for password sign-in as Langflow’s upgrade guidance describes. Langflow 1.13 turns automatic login off by default;
LANGFLOW_AUTO_LOGINis on by default in 1.12.8, and The Hacker News notes that IBM’s bulletin does not say whether servers with it turned off are vulnerable to the authentication-bypass issue. - Upgrade the Python package with
pip install --upgrade "langflow==1.13.0", or move to thelangflowai/langflow:1.13.0Docker image while keeping the deployment’s persistent data. - If you cannot sign in afterwards, follow the recovery steps in Langflow’s upgrade guidance. Do not delete or reinstall Langflow to get access back, because Langflow’s documentation warns this can permanently remove your flows.